4

We have this virtual machine that has Apache2 installed, we forgot to install a log rotate and we got 24gb of logs from Apache2, We removed those 24gb of log files but no changes occurred to the disk whatsoever, It was like I didn't removed the logs at all. Does any one understand what may have happened?

root@Web:~# cat /etc/*-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=10.04
DISTRIB_CODENAME=lucid
DISTRIB_DESCRIPTION="Ubuntu 10.04.4 LTS"

root@Web:~# df -kh
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda1              29G   27G  675M  98% /
none                  744M  176K  744M   1% /dev
none                  748M     0  748M   0% /dev/shm
none                  748M  568K  748M   1% /var/run
none                  748M     0  748M   0% /var/lock
none                  748M     0  748M   0% /lib/init/rw
none                   29G   27G  675M  98% /var/lib/ureadahead/debugfs

root@Web:~# du -kh /var/log/apache2
24G     /var/log/apache2

root@Web:~# rm /var/log/apache2/*

root@Web:~# du -kh /var/log/apache2
4.0K    /var/log/apache2

root@Web:~# df -kh
Filesystem            Size  Used Avail Use% Mounted on
/dev/sda1              29G   27G  673M  98% /
none                  744M  176K  744M   1% /dev
none                  748M     0  748M   0% /dev/shm
none                  748M  568K  748M   1% /var/run
none                  748M     0  748M   0% /var/lock
none                  748M     0  748M   0% /lib/init/rw
none                   29G   27G  673M  98% /var/lib/ureadahead/debugfs
1
  • Did you restart apache after removing files?
    – cuonglm
    Jul 5, 2014 at 13:51

2 Answers 2

3

This is most likely because you did not actually remove the files.
What I think that happened is the following:

  1. Logfiles were created and a program (read: Apache) wrote to them using a file-handle.
    The file also shows up in your directory listing.
  2. You tried to delete the files using rm of a similar way while Apache still has them open.
  3. The files are now partially deleted. The directory listing is gone. But the file is still there and will remain on disk until all the handles pointing to it get closed.

The easiest way to do this is restart Apache by sending it a SIGHUP. (Sending a HUP to Apache tells it to do a gracefully restart which among other things makes it close/reopen the log files.) You can send such a command via kill -1 (see man kill for more information).

1

You deleted the logs, but Apache keeps the files open.

The space will be reclaimed as soon as you restart (not reload) it.

Next time, you can truncate the logs instead of deleting them, using > logfile or cat /dev/null > logfile

Not the answer you're looking for? Browse other questions tagged .